diff --git a/src/pkcs11/README.md b/src/pkcs11/README.md new file mode 100644 index 0000000..413a7eb --- /dev/null +++ b/src/pkcs11/README.md @@ -0,0 +1,215 @@ +# PKCS #11 Test + +## On this page: +1. [Introduction](#1-introduction) +2. [Prerequisites For PKCS #11 Test](#2-prerequisites-for-pkcs-11-test) +3. [PKCS #11 Test Configurations](#3-pkcs-11-test-configurations) +4. [Source Code Organization](#4-source-code-organization) +5. [Implement PKCS #11 Test Application](#5-implement-pkcs-11-test-application) +6. [Run The PKCS #11 Test](#6-run-the-pkcs-11-test)
+6.1 [Setup the provisioning mechanism and key function](#61-setup-the-provisioning-mechanism-and-key-function)
+6.2 [Compile and run the PKCS #11 test application](#62-compile-and-run-the-pkcs-11-test-application)
+ +## 1. Introduction +[PKCS #11 ](https://en.wikipedia.org/wiki/PKCS_11) is a standardize API to allow application software to use, create, modify and delete cryptographic objects. +The benefit of PKCS #11 is that it allows the app to take advantage of offload crypto while mitigating the threats of private key cloning and theft. + +To keep as lean as possible, FreeRTOS uses a subset of PKCS #11 APIs. Implementers are free to integrate more than our required subset of PKCS #11, but it is optional to do so. + +The PKCS #11 API functions required by FreeRTOS are described in the following table. + +FreeRTOS Library | Required PKCS #11 API Family +----------------------- | ---------------------------- +Any | Initialize, Finalize, Open/Close Session, GetSlotList, Login +Provisioning Demo | GenerateKeyPair, CreateObject, DestroyObject, InitToken, GetTokenInfo +TLS | Random, Sign, FindObject, GetAttributeValue +FreeRTOS+TCP | Random, Digest +OTA | Verify, Digest, FindObject, GetAttributeValue + +The PKCS #11 test validates the PKCS #11 subset implementation. The test directly exercises the PKCS #11 implementation on the device under testing. User runs the PKCS #11 test by running a test application. The test application is usually implemented by calling the provided PKCS #11 test routine from the main function. By passing this test, the PKCS #11 subset implementation is validated to support required PKCS #11 functions by FreeRTOS. + +The PKCS #11 interface is defined in the open-standard documentation available here http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html. + +## 2. Prerequisites For PKCS #11 Test +The PKCS #11 tests assume the tested platform already has the following components integrated. +* **The PKCS #11 APIs subset implementation**
+ The implementation should support the APIs list in this [section](#1-introduction). +* **corePKCS11**
+ The utilities in corePKCS #11 are used in PKCS #11 test. corePKCS11 library provides software based implementation. Developers can implement the required PKCS #11 APIs using hardware crypto features of their board. The PKCS #11 Test does not mandate specific implementation. +* **MbedTLS**
+ MbedTLS is required to verify the result of the PKCS #11 implementation. +* **Unity test framework**
+ PKCS #11 test make use of the Unity test framework. Reference the [website](https://github.com/ThrowTheSwitch/Unity) for integration guide. + +## 3. PKCS #11 Test Configurations + +The following table lists the required test configurations for PKCS #11 tests. These test configurations need to be defined in **test_param_config.h**. + +|Configuration |Description | +|--- | --- | +|PKCS11_TEST_RSA_KEY_SUPPORT |The porting supports RSA key functions. | +|PKCS11_TEST_EC_KEY_SUPPORT |The porting supports EC key functions. | +|PKCS11_TEST_IMPORT_PRIVATE_KEY_SUPPORT |The porting supports import private key. RSA and EC key import will be validated in the test if the corresponding key functions are enabled. | +|PKCS11_TEST_GENERATE_KEYPAIR_SUPPORT |The porting supports keypair generation. EC keypair generation will be validated in the test if the corresponding key functions are enabled. | +|PKCS11_TEST_PREPROVISIONED_SUPPORT |The porting has pre-provisioned credentials. These test labels, PKCS11_TEST_LABEL_DEVICE_PRIVATE_KEY_FOR_TLS, PKCS11_TEST_LABEL_DEVICE_PUBLIC_KEY_FOR_TLS and PKCS11_TEST_LABEL_DEVICE_CERTIFICATE_FOR_TLS, are the labels of the pre-provisioned credentials. | +|PKCS11_TEST_LABEL_DEVICE_PRIVATE_KEY_FOR_TLS |The label of the private key used in the test. | +|PKCS11_TEST_LABEL_DEVICE_PUBLIC_KEY_FOR_TLS |The label of the public key used in the test. | +|PKCS11_TEST_LABEL_DEVICE_CERTIFICATE_FOR_TLS |The label of the certificate used in the test. | +|PKCS11_TEST_JITP_CODEVERIFY_ROOT_CERT_SUPPORTED |The porting supports storage for JITP. Set 1 to enable the JITP codeverify test. | +|PKCS11_TEST_LABEL_CODE_VERIFICATION_KEY |The label of the code verification key used in JITP codeverify test. | +|PKCS11_TEST_LABEL_JITP_CERTIFICATE |The label of the JITP certificate used in JITP codeverify test. | +|PKCS11_TEST_LABEL_ROOT_CERTIFICATE |The label of the root certificate used in JITP codeverify test. | + + +FreeRTOS libraries and reference integrations needs at least one of the key function and one of the key provisioning mechanism supported by the PKCS #11 APIs. The test must enable at least one of the following configurations: + +* At least one of the key function configurations: + * PKCS11_TEST_RSA_KEY_SUPPORT + * PKCS11_TEST_EC_KEY_SUPPORT +* At least one of the key provisioning mechanisms: + * PKCS11_TEST_IMPORT_PRIVATE_KEY_SUPPORT + * PKCS11_TEST_GENERATE_KEYPAIR_SUPPORT + * PKCS11_TEST_PREPROVISIONED_SUPPORT + + +Pre-provisioned device credential test can not be enabled with other provisioning mechanisms. It must be run in the following conditions: + +* Enable **PKCS11_TEST_PREPROVISIONED_SUPPORT** and the other provisioning mechanisms must be disabled +* Only one of the key function, **PKCS11_TEST_RSA_KEY_SUPPORT** or **PKCS11_TEST_EC_KEY_SUPPORT**, enabled +* Setup the pre-provisioned key labels according to your key function, including **PKCS11_TEST_LABEL_DEVICE_PRIVATE_KEY_FOR_TLS**, **PKCS11_TEST_LABEL_DEVICE_PUBLIC_KEY_FOR_TLS** and **PKCS11_TEST_LABEL_DEVICE_CERTIFICATE_FOR_TLS**. These credentials must exist in the PKCS #11 before running the test. + +You may need to run the test several times with different configurations if your implementation support pre-provisioned credentials and other provisioning mechanisms. + + +>Note: +Objects with label **PKCS11_TEST_LABEL_DEVICE_PRIVATE_KEY_FOR_TLS**, **PKCS11_TEST_LABEL_DEVICE_PUBLIC_KEY_FOR_TLS** and **PKCS11_TEST_LABEL_DEVICE_CERTIFICATE_FOR_TLS** will be destroyed during the test if any one of **PKCS11_TEST_GENERATE_KEYPAIR_SUPPORT** and **PKCS11_TEST_GENERATE_KEYPAIR_SUPPORT** is enabled. + +## 4. Source Code Organization +The tree only lists the required files to run the PKCS #11 test. +``` +./FreeRTOS-Libraries-Integration-Tests/ +├── config_template +│ ├── test_execution_config_template.h +│ └── test_param_config_template.h +└── src + ├── common + │ └── platform_function.h + ├── pkcs11 + │ ├── core_pkcs11_test.c + │ ├── core_pkcs11_test.h + │ ├── ecdsa_test_credentials.h + │ ├── rsa_test_credentials.h + │ └── dev_mode_key_provisioning + │ ├── dev_mode_key_provisioning.c + │ └── dev_mode_key_provisioning.h + ├── qualification_test.c + └── qualification_test.h +``` + +## 5. Implement PKCS #11 Test Application +1. Add [FreeRTOS-Libraries-Integration-Tests](https://github.com/FreeRTOS/FreeRTOS-Libraries-Integration-Tests) as a submodule into your project. It doesn’t matter where the submodule is placed in the project, as long as it can be built. +2. Copy **config_template/test_execution_config_template.h** and **config_template/test_param_config_template.h** to a project location in the build path, and rename them to **test_execution_config.h** and **test_param_config.h**. +3. Include relevant files into the build system. If using CMake, **qualification_test.cmake** and **src/pkcs11_test.cmake** can be used to include relevant files. +4. Implement the [platform functions](https://github.com/FreeRTOS/FreeRTOS-Libraries-Integration-Tests/blob/main/src/common/platform_function.h) required by PKCS #11 tests. +5. Enable the PKCS #11 test config, **PKCS11_TEST_ENABLED**, in **test_execution_config.h**. +6. Implement the main function and call the **RunQualificationTest**. + +The following is an example test application. + +```C +#include "platform_function.h" +#include "qualification_test.h" + +FRTestThreadHandle_t FRTest_ThreadCreate( FRTestThreadFunction_t threadFunc, void * pParam ) +{ + /* Thread create function for multithreaded test. */ +} + +int FRTest_ThreadTimedJoin( FRTestThreadHandle_t threadHandle, uint32_t timeoutMs ) +{ + /* Thread timed wait function for multithreaded test. */ +} +void * FRTest_MemoryAlloc( size_t size ) +{ + /* Malloc function to allocate memory for test. */ +} + +void FRTest_MemoryFree( void * ptr ) +{ + /* Free function to free memory allocated by FRTest_MemoryAlloc function. */ +} + +void yourMainFunction( void ) +{ + RunQualificationTest(); +} + +``` + +## 6. Run The PKCS #11 Test +### 6.1 Setup the provisioning mechanism and key function +Setup the provisioning mechanism and key function in **test_param_config.h** according to the device capability. +The following is a sample test_param_config.h if corePKCS11 is used for the PKCS #11 implementation. +```C +#include "core_pkcs11_config.h" + +/* Setup key function. */ +#define PKCS11_TEST_RSA_KEY_SUPPORT ( 1 ) +#define PKCS11_TEST_EC_KEY_SUPPORT ( 1 ) + +/* Setup provisioning method. */ +#define PKCS11_TEST_IMPORT_PRIVATE_KEY_SUPPORT ( 1 ) +#define PKCS11_TEST_GENERATE_KEYPAIR_SUPPORT ( 1 ) +#define PKCS11_TEST_PREPROVISIONED_SUPPORT ( 0 ) + +/* The device credential labels. */ +#define PKCS11_TEST_LABEL_DEVICE_PRIVATE_KEY_FOR_TLS pkcs11configLABEL_DEVICE_PRIVATE_KEY_FOR_TLS +#define PKCS11_TEST_LABEL_DEVICE_PUBLIC_KEY_FOR_TLS pkcs11configLABEL_DEVICE_PUBLIC_KEY_FOR_TLS +#define PKCS11_TEST_LABEL_DEVICE_CERTIFICATE_FOR_TLS pkcs11configLABEL_DEVICE_CERTIFICATE_FOR_TLS + +/* JITP credential labels. */ +#define PKCS11_TEST_JITP_CODEVERIFY_ROOT_CERT_SUPPORTED pkcs11configJITP_CODEVERIFY_ROOT_CERT_SUPPORTED +#define PKCS11_TEST_LABEL_CODE_VERIFICATION_KEY pkcs11configLABEL_CODE_VERIFICATION_KEY +#define PKCS11_TEST_LABEL_JITP_CERTIFICATE pkcs11configLABEL_JITP_CERTIFICATE +#define PKCS11_TEST_LABEL_ROOT_CERTIFICATE pkcs11configLABEL_ROOT_CERTIFICATE +``` + +### 6.2 Compile and run the PKCS #11 test application +Compile and run the test application in your development environment. +The following is a sample test result log: +``` +TEST(Full_PKCS11_StartFinish, PKCS11_StartFinish_FirstTest) PASS +TEST(Full_PKCS11_StartFinish, PKCS11_GetFunctionList) PASS +TEST(Full_PKCS11_StartFinish, PKCS11_InitializeFinalize) PASS +TEST(Full_PKCS11_StartFinish, PKCS11_GetSlotList) PASS +TEST(Full_PKCS11_StartFinish, PKCS11_OpenSessionCloseSession) PASS +TEST(Full_PKCS11_Capabilities, PKCS11_Capabilities) PASS +TEST(Full_PKCS11_NoObject, PKCS11_Digest) PASS +TEST(Full_PKCS11_NoObject, PKCS11_Digest_ErrorConditions) PASS +TEST(Full_PKCS11_NoObject, PKCS11_GenerateRandom) PASS +TEST(Full_PKCS11_NoObject, PKCS11_GenerateRandomMultiThread) PASS +TEST(Full_PKCS11_RSA, PKCS11_RSA_CreateObject) PASS +TEST(Full_PKCS11_RSA, PKCS11_RSA_FindObject) PASS +TEST(Full_PKCS11_RSA, PKCS11_RSA_GetAttributeValue) PASS +TEST(Full_PKCS11_RSA, PKCS11_RSA_Sign) PASS +TEST(Full_PKCS11_RSA, PKCS11_RSA_FindObjectMultiThread) PASS +TEST(Full_PKCS11_RSA, PKCS11_RSA_GetAttributeValueMultiThread) PASS +TEST(Full_PKCS11_RSA, PKCS11_RSA_DestroyObject) PASS +TEST(Full_PKCS11_EC, PKCS11_EC_GenerateKeyPair) PASS +TEST(Full_PKCS11_EC, PKCS11_EC_CreateObject) PASS +TEST(Full_PKCS11_EC, PKCS11_EC_FindObject) PASS +TEST(Full_PKCS11_EC, PKCS11_EC_GetAttributeValue) PASS +TEST(Full_PKCS11_EC, PKCS11_EC_Sign) PASS +TEST(Full_PKCS11_EC, PKCS11_EC_Verify) PASS +TEST(Full_PKCS11_EC, PKCS11_EC_FindObjectMultiThread) PASS +TEST(Full_PKCS11_EC, PKCS11_EC_GetAttributeValueMultiThread) PASS +TEST(Full_PKCS11_EC, PKCS11_EC_SignVerifyMultiThread) PASS +TEST(Full_PKCS11_EC, PKCS11_EC_DestroyObject) PASS + +----------------------- +27 Tests 0 Failures 0 Ignored +OK + +``` + +